#!/usr/bin/env bash startup_dirs=(/Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents ~/Library/LaunchDaemons /etc/emond.d/rules/) system_dirs=(/System/Library/LaunchAgents /System/Library/LaunchDaemons) RED='\033[0;31m' GREEN='\033[0;32m' YELLOW='\033[1;33m' NC='\033[0m' BOLD='\033[1m' # #-------------------------------------------------------------------------------------------------------------------------------------- # function isSystemItemsEnabled() { [[ "${ML_SYSTEM}" == "1" ]] } function join_by { local IFS="$1"; shift; echo "$*"; } function usage { # show command cli usage help echo "Usage: $0 (item name|system)" exit 1 } function error { # show an error message and exit echo -e "${RED}ERROR:${N} ${1}${NC}" exit 1 } function isSystem { # if it's in /System, it's part of the (protected) system partition [[ $1 == /System/* ]] } function getScriptUser { local scriptPath="$1" # if it's in LaunchAgents, it's ran as the user if echo "$scriptPath" | grep -sqi "LaunchAgent"; then whoami return fi # if there is no UserName key, it's ran as root if ! grep -sqi 'UserName' "$scriptPath"; then echo "root" return fi # if UserName key is present, return the custom user grep -si 'UserName' -C1 "$scriptPath" | tail -n1 | cut -d '>' -f 2 | cut -d '<' -f 1 } function getKernelExtensions { kmutil showloaded --no-kernel-components --list-only --sort --show loaded 2>/dev/null | tr -s ' ' | grep -v 'com\.apple\.' } function getCronjobs { while IFS= read -r cron; do if [ -z "$cron" ]; then continue fi if echo "$cron" | cut -d ' ' -f 1 | grep -q '@'; then # @reboot notation echo "$cron" | cut -d ' ' -f 2 else # * * * * * notation echo "$cron" | cut -d ' ' -f 6 fi done <<<"$(crontab -l 2>/dev/null | grep -v '^#' | grep -vE '^\n')" } function listCronJobs { local filter="$1" getCronjobs | while IFS= read -r name; do if [ -n "$filter" ] && ! [[ "$name" =~ $filter ]]; then continue fi echo -e "${BOLD}> ${name}${NC}" echo -e " Type : cronjob" echo -e " User : $(whoami)" echo -e " Launch: ${ORANGE}enabled${NC}" echo " File : ${name}" done } function listPeriodic() { local filter="$1" if ! isSystemItemsEnabled; then return fi find /etc/periodic -type f | while IFS= read -r name; do mode="daily" if [[ ${name} =~ /etc/periodic/weekly ]]; then mode="weekly" elif [[ ${name} =~ /etc/periodic/monthly ]]; then mode="monthly" fi if [ -n "$filter" ] && ! [[ "$name" =~ $filter ]]; then continue fi echo -e "${BOLD}> ${name}${NC}" echo -e " Type : periodic" echo -e " User : $(whoami)" echo -e " Launch: ${YELLOW}${mode}${NC}" echo " File : ${name}" done } function enablePeriodic() { local filter="$1" find /etc/periodic -type f | while IFS= read -r name; do if [ -n "$filter" ] && ! [[ "$name" =~ $filter ]]; then continue fi echo -e "${BOLD}${YELLOW}Warning: enable individual periodic scripts in /etc/defaults/periodic.conf${NC}" return done } function disablePeriodic() { local filter="$1" find /etc/periodic -type f | while IFS= read -r name; do if [ -n "$filter" ] && ! [[ "$name" =~ $filter ]]; then continue fi echo -e "${BOLD}${YELLOW}Warning: disable individual periodic scripts in /etc/defaults/periodic.conf${NC}" return done } function listKernelExtensions { local filter="$1" if ! isSystemItemsEnabled; then return fi getKernelExtensions | while IFS= read -r kextLine; do kextLoaded="$(echo "$kextLine" | cut -d ' ' -f 3)" kextName="$(echo "$kextLine" | cut -d ' ' -f 7)" kextVersion="$(echo "$kextLine" | grep -o '$(.*)$')" if [ "$filter" == "disabled" ] && [ "$kextLoaded" != "0" ]; then continue fi if [ "$filter" == "enabled" ] && [ "$kextLoaded" == "0" ]; then continue fi if [ -n "$filter" ] && [ "$filter" != "system" ] && [ "$filter" != "enabled" ] && [ "$filter" != "disabled" ]; then if [[ "$kextName" != *"$filter"* ]]; then continue fi fi kernelPath="$(kextfind -system-extensions "$kextName" 2>/dev/null)" if [ -z "$kernelPath" ]; then kernelPath="n/a" fi local loaded if [ "$kextLoaded" == "0" ]; then loaded="${GREEN}${BOLD}disabled${NC}" else loaded="${RED}Always${NC}" fi echo -e "${BOLD}> ${kextName}${NC} ${kextVersion}" echo -e " Type : ${RED}kernel extension${NC}" echo -e " User : ${RED}root${NC}" echo -e " Launch: ${loaded}" echo " File : ${kernelPath}" done } function disableKernelExtensions { local filter="$1" getKernelExtensions | while IFS= read -r kextLine; do kextLoaded="$(echo "$kextLine" | cut -d ' ' -f 3)" kextName="$(echo "$kextLine" | cut -d ' ' -f 7)" if ! [[ "$kextName" =~ $filter ]]; then continue fi if [ "$kextLoaded" == "0" ]; then #error "kernel extension is already unloaded" continue fi if ! kmutil load -b "$kextName" 1>/dev/null; then error "could not disable kernel extension" fi echo -e "${GREEN}Disabled ${STRONG}${kextName}${NC}" done } function enableKernelExtensions { local filter="$1" getKernelExtensions | while IFS= read -r kextLine; do kextLoaded="$(echo "$kextLine" | cut -d ' ' -f 3)" kextName="$(echo "$kextLine" | cut -d ' ' -f 7)" if ! [[ "$kextName" =~ $filter ]]; then continue fi if ! [ "$kextLoaded" == "0" ]; then #error "kernel extension is already loaded" continue fi if ! kmutil unload -b "$kextName" 1>/dev/null; then error "could not disable kernel extension" fi echo -e "${GREEN}Enabled ${STRONG}${kextName}${NC}" done } function getSystemExtensions { systemextensionsctl list 2>/dev/null | tail -n+2 | grep -v '^---' | grep -v '^enabled' | tr -s ' ' } function listSystemExtensions { local filter="$1" getSystemExtensions | while IFS= read -r extLine; do fullName="$(echo "$extLine" | cut -d$'\t' -f 4)" extName="$(echo "$fullName" | cut -d ' ' -f 1)" extVersion="$(echo "$fullName" | grep -o '$(.*)$')" if [ -n "$filter" ] && ! [[ "$extName" =~ $filter ]]; then continue fi local loaded if [ "$(echo "$extLine" | cut -d$'\t' -f 2)" == "*" ]; then loaded="${ORANGE}enabled${NC}" else loaded="${GREEN}disabled${NC}" fi echo -e "${BOLD}> ${extName}${NC} ${extVersion}" echo -e " Type : system extension" echo -e " User : $(whoami)" echo -e " Launch: ${loaded}" echo " File : n/a" done } function enableSystemExtensions { local filter="$1" getSystemExtensions | while IFS= read -r extLine; do extName="$(echo "$extLine" | cut -d$'\t' -f 4 | cut -d ' ' -f 1)" if ! [[ "$extName" =~ $filter ]]; then continue fi if [ "$(echo "$extLine" | cut -d$'\t' -f 2)" == "*" ]; then # error "this system extension is already enabled" continue fi #TODO: implement load system extension via CLI error "enabling system extensions is not yet implemented" done } function disableSystemExtensions { local filter="$1" getSystemExtensions | while IFS= read -r extLine; do extName="$(echo "$extLine" | cut -d$'\t' -f 4 | cut -d ' ' -f 1)" if ! [[ "$extName" =~ $filter ]]; then continue fi if ! [ "$(echo "$extLine" | cut -d$'\t' -f 2)" == "*" ]; then # error "this system extension is already disabled" continue fi if ! systemextensionsctl uninstall '-' "$extName"; then error "could not disable system extension" fi echo -e "${GREEN}Enabled ${STRONG}${extName}${NC}" done } function getDisabledLoginItems { cat /var/db/com.apple.xpc.launchd/disabled.* | grep -is '' -A1 | grep -is '' | cut -d '>' -f 2 | cut -d '<' -f 1 } function listLoginItems { local filter="$1" runAsUser="$(whoami)" disabledLoginItems=$(getDisabledLoginItems) # for every plist found while IFS= read -r -d '' plistPath; do loginItems=$(cat "$plistPath" | grep key | cut -d '>' -f 2 | cut -d '<' -f 1) for loginItem in ${loginItems[@]}; do if [ -n "$filter" ] && [ "$filter" != "enabled" ] && [ "$filter" != "disabled" ]; then if [[ "$loginItem" != *"$filter"* ]]; then continue fi fi local launchState="" for disabledLoginItem in ${disabledLoginItems[@]}; do if [[ "$loginItem" == "$disabledLoginItem" ]]; then launchState="${GREEN}${BOLD}disabled" break fi done if [ -z "" ]; then launchState="${YELLOW}LoginItem" fi echo -e "${BOLD}> ${loginItem}${NC}${startup_type}" echo " Type : LoginItem" echo -e " User : ${runAsUser}" echo -e " Launch: ${launchState}${NC}" echo " File : ${plistPath}" done done< <(find /var/db/com.apple.xpc.launchd -iname "loginitems.*.plist" -print0 2>/dev/null) } function listLaunchItems { local filter="$2" itemDirectories=("${startup_dirs[@]}") # get disabled services disabled_services="$(launchctl print-disabled user/"$(id -u)")" # add system dirs too if we supplied the system parameter if [ "$filter" == "system" ]; then if isSystemItemsEnabled; then itemDirectories=("${itemDirectories[@]}" "${system_dirs[@]}") filter="" fi fi # login hooks if loginHooks=$(defaults read com.apple.loginwindow LoginHook 2>/dev/null); then echo -e "${RED}${BOLD}Warning: you have Login Hooks!${NC}" echo -e "${RED}Remove them (with sudo) from /var/root/Library/Preferences/com.apple.loginwindow" echo -e "${loginHooks}${NC}" echo echo fi # logout hooks if logoutHooks=$(defaults read com.apple.loginwindow LogoutHook 2>/dev/null); then echo -e "${RED}${BOLD}Warning: you have Login Hooks!${NC}" echo -e "${RED}Remove them (with sudo) from /var/root/Library/Preferences/com.apple.loginwindow" echo -e "${logoutHooks}${NC}" echo echo fi # for every plist found while IFS= read -r -d '' f; do # check if file is readable if ! [ -r "$f" ]; then echo -e "\nSkipping unreadable file: $f\n" continue fi # convert plist to XML if it is binary if ! content=$(plutil -convert xml1 "${f}" -o -); then error "Unparseable file: $f" fi # detect the process type type="system" ; [[ "$f" =~ .*LaunchAgents.* ]] && type="user" # extract the service name startup_name="$(basename "$f" | sed -E 's/\.plist(\.disabled)*$//')" if [ -n "$filter" ] && [ "$filter" != "enabled" ] && [ "$filter" != "disabled" ]; then if [[ "$startup_name" != *"$filter"* ]]; then continue fi fi local load_items=() # check for legacy behavior if [[ $f =~ \.disabled$ ]]; then # skip it if we only want enabled items if [ -n "$filter" ] && [ "$filter" == "enabled" ]; then continue fi load_items=("${GREEN}${BOLD}disabled${NC}${YELLOW} (legacy)") # check if it's disabled natively via launchctl elif echo "$disabled_services" | grep -iF "$startup_name" | grep -Eqi '(true|disabled)'; then # skip it if we only want enabled items if [ -n "$filter" ] && [ "$filter" == "enabled" ]; then continue fi load_items=("${GREEN}${BOLD}disabled") # check if enabled is set to false in the plist elif echo "${content}" | tr -d '\n' | tr -d '\t' | tr -d ' ' | grep -q 'enabled ${startup_name}${NC}${startup_type}" echo " Type : ${type}" echo -e " User : ${runAsUser}" echo -e " Launch: ${load_str}${NC}" echo " File : $f" done< <(find "${itemDirectories[@]}" -type f -iname '*.plist*' -print0 2>/dev/null) } function enableLaunchItems { disabled_items="$(launchctl print-disabled user/"$(id -u)")" while IFS= read -r -d '' startupFile; do # error out if we didn't find a plist if [ -z "$startupFile" ]; then error "Could not read $1" fi # fix legacy .disabled behavior startupFile="$(echo "$startupFile" | sed -E 's/(\.disabled)$//')" disabledFile="${startupFile}.disabled" if [ -f "$disabledFile" ] && ! mv "$disabledFile" "$startupFile"; then error "could not move '$startupFile' to '$disabledFile'. Try to run with sudo?" fi name="$(basename "$startupFile" | sed -E 's/\.plist(\.disabled)*$//')" # check if it's disabled if ! echo "$disabled_items" | grep -iF "$name" | grep -q true; then error "$name is already enabled" fi # try to enable it if ! launchctl enable user/"$(id -u)"/"${name}"; then error "Could not enable ${STRONG}$name${NC}" fi echo -e "${GREEN}Enabled ${STRONG}${name}${NC}" done< <(find "${startup_dirs[@]}" "${system_dirs[@]}" $ -iname "*$1*.plist" -o -iname "*$1*.plist.disabled" $ -print0 2>/dev/null) } function disableLaunchItems { disabled_items="$(launchctl print-disabled user/"$(id -u)")" while IFS= read -r -d '' startupFile; do # error out if we didn't find a plist if [ -z "$startupFile" ]; then error "Could not find plist for $1" fi # fix legacy .disabled behavior startupFile="$(echo "$startupFile" | sed -E 's/(\.disabled)$//')" disabledFile="${startupFile}.disabled" if [ -f "$disabledFile" ] && ! mv "$disabledFile" "$startupFile"; then error "could not move '$startupFile' to '$disabledFile'. Try to run with sudo?" fi name="$(basename "$startupFile" | sed -E 's/\.plist(\.disabled)*$//')" # check if it's enabled if echo "$disabled_items" | grep -iF "$name" | grep -q true; then error "$name is already disabled" fi # try to disable it if ! launchctl disable user/"$(id -u)"/"${name}"; then error "Could not disable ${STRONG}$name${NC}" fi echo -e "${GREEN}Disabled ${STRONG}${name}${NC}" done< <(find "${startup_dirs[@]}" "${system_dirs[@]}" $ -iname "*$1*.plist" -o -iname "*$1*.plist.disabled" $ -print0 2>/dev/null) } # #-------------------------------------------------------------------------------------------------------------------------------------- # if [ $# -lt 1 ] || [ $# -gt 2 ]; then usage fi case "$1" in "list") if [ $# -ne 1 ] && [ $# -ne 2 ]; then usage fi listLoginItems "$2" listCronJobs "$2" listLaunchItems "$1" "$2" listKernelExtensions "$2" listSystemExtensions "$2" listPeriodic "$2" ;; "disable") if [ $# -ne 2 ]; then usage fi disableLoginItems "$2" disableLaunchItems "$2" disableKernelExtensions "$2" disableSystemExtensions "$2" disablePeriodic "$2" ;; "enable") if [ $# -ne 2 ]; then usage fi enableLaunchItems "$2" enableKernelExtensions "$2" enableSystemExtensions "$2" enablePeriodic "$2" ;; *) usage ;; esac